fix(kb): enforce server-owned folder connector limits

[erichare]

Summary

• overwrite folder connector roots with operator-owned settings at both public ingestion routes
• make the per-file ceiling operator-owned while preserving the existing 25 MiB default
• prevent request payloads from weakening filesystem and size boundaries

Testing

• 41 focused backend route/source tests passed
• 33 isolated LFX settings tests passed
• Ruff and pre-commit passed

Summary by CodeRabbit

• New Features

  • Added an operator-configurable per-file size limit for folder ingestion, defaulting to 25 MiB.
  • Folder ingestion now consistently enforces configured allowed folders and file-size limits across supported ingestion methods.
  • Requests can no longer override the server-configured file-size limit.

• Bug Fixes

  • Improved validation and clearer messaging when folder access settings are missing or invalid.
  • Ensured ingestion deduplication reflects the secured folder configuration.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8a4b65ec-c688-4ead-8777-d9919695108f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Folder ingestion now applies operator-owned allowed roots and per-file size limits across direct and connector routes. A validated PathSettings limit is added, request schema ownership is updated, and endpoint tests cover enforcement, rejection, and deduplication inputs.

Changes

Folder ingestion security

Layer / File(s)	Summary
Operator file-size setting src/lfx/src/lfx/services/settings/groups/paths.py, src/lfx/tests/unit/services/settings/*	Adds the positive kb_folder_max_file_size_bytes setting with a 25 MiB default, environment binding, validation, and settings-composition coverage.
API security enforcement src/backend/base/langflow/api/v1/knowledge_bases.py, src/backend/tests/unit/base/knowledge_bases/test_connector_endpoints.py, src/lfx/src/lfx/base/knowledge_bases/ingestion_sources/folder.py	Centralizes operator security overrides for direct and connector folder ingestion, uses secured configuration for connector deduplication, removes the request schema field, and updates validation documentation and endpoint tests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ingest_via_connector
  participant SecuritySettings
  participant FolderSource
  Client->>ingest_via_connector: Submit folder source configuration
  ingest_via_connector->>SecuritySettings: Read allowed roots and max file size
  SecuritySettings-->>ingest_via_connector: Return operator policy
  ingest_via_connector->>FolderSource: Create source with secured configuration
  FolderSource-->>ingest_via_connector: Validate folder configuration

Loading

Possibly related PRs

• langflow-ai/langflow#13448: Adds the folder-root setting used by folder-ingestion allow-list enforcement.

Suggested reviewers: himavarshavs, antonioablima, adam-aghili, ogabrielluiz

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: server-owned enforcement of folder connector limits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	Yes—the PR adds concrete tests for folder security overrides, schema removal, settings defaults/env binding, and field composition; names follow project conventions.
Test Quality And Coverage	✅ Passed	Tests cover success/error paths for both ingestion routes, assert security overrides and schema changes, and use valid async pytest patterns with auto-mode.
Test File Naming And Structure	✅ Passed	Touched tests are correctly named test_*.py, use standard pytest classes/functions, and cover positive and negative cases; no frontend tests were added.
Excessive Mock Usage Warning	✅ Passed	Mocks are confined to external services and env isolation; core settings/route behavior is exercised with real objects and dedicated regression tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/le-1778-kb-connector-roots

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	43.53% (58077/133393)	69.19% (7885/11395)	41.56% (1298/3123)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
4979	0 💤	0 ❌	0 🔥	14m 5s ⏱️

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.74%. Comparing base (912b4a4) to head (4e26604).
⚠️ Report is 13 commits behind head on release-1.10.3.

Additional details and impacted files

@@                Coverage Diff                 @@
##           release-1.10.3   #14039      +/-   ##
==================================================
+ Coverage           58.71%   58.74%   +0.03%     
==================================================
  Files                2307     2312       +5     
  Lines              220314   221675    +1361     
  Branches            31177    34411    +3234     
==================================================
+ Hits               129354   130222     +868     
- Misses              89475    89890     +415     
- Partials             1485     1563      +78     

Flag	Coverage Δ
frontend	57.82% <ø> (-0.07%)	⬇️
lfx	55.23% <ø> (+0.57%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 250 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Adam-Aghili]

FIxes the reported issue but would like someone with more KB knowledge to validate it doesn't break expected behaviour